Jamie Dicken

"The threat actor behind the exploitation of vulnerable Craft Content Management System (CMS) instances has shifted its tactics to target Magento CMS and misconfigured Docker instances. The activity has been attributed to a threat actor tracked as Mimo (aka Hezb), which has a long history of leveraging N-day security flaws in various web applications to deploy cryptocurrency miners. "Although Mimo's primary motivation remains financial, through cryptocurrency mining and bandwidth monetization, the sophistication of their recent operations suggests potential preparation for more lucrative criminal activities," Datadog Security Labs said in a report published this week. Mimo's exploitation of CVE-2025-32432, a critical security flaw in Craft CMS, for cryptojacking and proxyjacking was documented by Sekoia in May 2025." https://lnkd.in/d-j33inX

1

Has anyone ever been caught off guard by a compliance audit? I had a similar experience, witnessing one audit uncover 17 critical violations. No kidding. The platform wasn't built with "security by default" in mind. Essentially, they were ticking time bombs scattered throughout the code. The catch? Potential fines over a million euros. Yes, you read that right. What my team and I faced: rebuilding their entire system with compliance principles in mind, from secure data handling to audit-ready dashboards and reporting. Night shifts? Sure. Extra coffee? Always. 🙃 And here it is, the next audit: a clean slate. Passed with flying colors. There's nothing worse than suddenly discovering that your product is not just buggy, but legally insecure. Have you ever had a compliance audit reveal hidden risks you didn't anticipate? How did you deal with them? #fintech #compliance #security #auditready #softwaredevelopment #hygge #startup #riskmanagement

7

Couldn't agree with this more. For example, how many high/critical PHP "findings" in your vuln scan reports that are meaningless because that function isn't used (or used with user input). Teams work hard to remediate issues that have zero impact, largely because it shows up in a dashboard, metrics, or KPIs... not because it matters.

23

6 Comments

The most expensive mistake in security installs? Wasting time you’ll never get paid for. Too often, hours disappear on site fixing things that could’ve been solved before you ever rolled a truck. Time lost = margin lost. Start treating pre-deployment as a profit strategy, not an afterthought. Test, configure, and streamline at the bench before setting foot on site. Where are you still losing hours that your future self will wish you took back?

35

1 Comment

Where do our thoughts come from? Today, I got excited about implementing automation to handle remediation. Then came that part of my brain that says it's too easy, it's too good. The product vendor is saying all the things I've heard before. For example, we took ALL the necessary preventative measures to ensure abc and xyz. Just trust us, all our other clients have, so what's your problem? I, of course, begin to fantasize about circumventing said measures if one were to need to do so at all. Just hand me some popcorn and pay my bills until I'm done. The fact is that all these tools, which can isolate systems, interact with system folders and files, and disable accounts, can be turned against us in a living-off-the-land attack. I'm exploring Azure Logic apps as well, and after 40 minutes of euphoria, that sadness creeps in. This, too, can be turned against us. Consider this: we invest a significant amount of time in establishing separation of duties and least privilege access, only to create a separate space where those principles are disregarded. That one workflow has Godmode. All it takes is a new bug that allows for exploiting your global admin or domain admin creds, and all that segmentation you spent months planning and implementing goes out the door. Ok, enough venting!! What additional steps are you adding to add security to automation in your environment? You can skip the basics in your answer...

3

If the extent of your BCP/DR is a compliance questionnaire asking, "Are you using multiple availability zones, replication across regions" .... you may be "compliant", but you're not resilient to an outage and likely wouldn't have a fun time dealing with an adversary. Seems like tribal knowledge, but sadly, it isn't.

2

Privacy concerns aside, major software and hardware security lapses like this are not okay and cannot be brushed aside no matter how hard they may try. This points to a lot of systemic issues within the company itself that we are not seeing. If you use any Flock devices you should be heavily reconsidering after this latest report.  https://lnkd.in/evw9SPAn

7

One thing that I have learned while being in software security is that auditors like a good story and documentation. This is why being in "compliance" doesn't equate to being secure. It doesn't mean that "compliance" is bad. Or that it isn't a valid place to start thinking about security. It just means exactly what it says. Let's take user data deletion for things like GDPR and California Privacy laws. In nearly all cases, a company cannot delete all of a users data. Why? Because in most cases they don't even know where all of their customers data lives. Backups, data migrations, data movements, internal applications, and more. So, what happens? They typically manage it by "forgetting" the data through some sort of logical implementation. Either deactivating encryption keys, dealing with database ids or something similar. The data itself still resides. It still exists. #ai #softwareengineering #softwaresecurity #compliance

6

A bit of a follow-up to my post about Cloudflare workers last week... I think all the JSON formatters/linters/repair tools out there are pretty terrible. So... I spent a few hours this weekend building https://json.repair which is basically just a vibe coded, but improved version of these things. 🚀 Instant JSON Repair - Paste almost anything, get valid JSON 🎯 Smart Error Detection - Pinpoint exact line/column issues with visual markers 💻 Multi-Language Export - Generate code snippets in Python, Java, C++, TypeScript & more 🎨 Clean, Ad-Free UI - No bloat, no ads, its free to me so its free to you 🔧 Advanced Formatting - Pretty-print, minify, and visualize JSON trees If you haven't played with this stuff yet, I highly encourage you to. Its kind of amazing how fast we can build these days. My sort of lofty goal is to try to do one of these tools or resources, a month, for the next year. Checkout my running pace chart from last week too! https://pacech.art Thanks to Jack, Geoff, and Benson for the ideas and feedback!

21

4 Comments

Security can’t be a checkbox. You're not secure if your AppSec isn’t built into the pipeline. You’re just hoping the attackers are busy elsewhere.

2

1 Comment